HollowGraph hides C2 in Microsoft 365 calendars, targeting Israeli firms
Group‑IB discovered HollowGraph, a Windows malware that uses the Microsoft Graph API to turn compromised Microsoft 365 calendar entries into a two‑way command‑and‑control channel. By embedding encrypted commands and stolen data in calendar appointments, the threat evades typical network defenses and appears to focus on Israeli organizations, indicating a highly targeted espionage campaign.